[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Directory Traversal",
    "exploit": "Attacker supplies `path=../../etc/passwd` to escape `/srv/reports/` and read arbitrary files on the server filesystem.",
    "fix": "Resolve the full path using `pathlib.Path.resolve()` or `os.path.realpath()`, then verify it starts with the base directory. Alternatively, validate `path` against a strict whitelist or use `pathlib.PurePath` to reject traversal sequences."
  },
  {
    "severity": "High",
    "issue": "Sensitive Token Exposure via Query Parameter",
    "exploit": "FastAPI defaults string parameters to query strings. The `ADMIN_TOKEN` will be exposed in server logs, browser history, proxy logs, and network traffic.",
    "fix": "Change the parameter to a header using `Header()` or `Cookie()`, or switch to a POST endpoint with a JSON body. Example: `token: str = Header(...)`."
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack on Secret Comparison",
    "exploit": "Using `!=` for string comparison leaks information via response timing, allowing an attacker to guess the token character-by-character.",
    "fix": "Use `secrets.compare_digest(token, os.environ['ADMIN_TOKEN'])` for constant-time comparison."
  }
]